Change nRFutil settings to generate upload package for nRF52832 Adafruit framework

aashyk-mohaiteen · November 17, 2021, 6:30am

Hello,

I have been working platformIO for a while, and recently have been looking into enabling some advanced features in my product. The feature that I am currently focused on is getting the firmware build by the nRFutil tools to be cryptographically signed.
This following command is what I want to implement in my platformIO environment
nrfutil pkg generate --application <path_to_hex_file> --application-version 0 --hw-version 52 --sd-req 0x98 --key-file private-key.pem dfu-app.zip
Does PlatformIO use the above command during upload process? If so, does adding the flags such as --key-file to upload_file be sufficient?

Any assistance is appreciated, Thanks!

maxgerhardt · November 17, 2021, 1:22pm

The upload process is a multi-step process.

The package zip file is generated with this command recipe

github.com

platformio/platform-nordicnrf52/blob/d29b3cc4e9a88addcd160b613281e461411dc62e/builder/main.py#L130-L147


      
          BUILDERS=dict(
              PackageDfu=Builder(
                  action=env.VerboseAction(" ".join([
                      '"$PYTHONEXE"',
                      '"%s"' % join(platform.get_package_dir(
                          "tool-adafruit-nrfutil") or "", "adafruit-nrfutil.py"),
                      "dfu",
                      "genpkg",
                      "--dev-type",
                      "0x0052",
                      "--sd-req",
                      board.get("build.softdevice.sd_fwid"),
                      "--application",
                      "$SOURCES",
                      "$TARGET"
                  ]), "Building $TARGET"),
                  suffix=".zip"
              ),

And since the a adafruit_feather_nrf52832 board the default upload protocol is

github.com

platformio/platform-nordicnrf52/blob/d5fed52653ed59717188b136475978395e7d6b15/boards/adafruit_feather_nrf52832.json#L61-L61


      
          "protocol": "nrfutil",

PlatformIO will

github.com

platformio/platform-nordicnrf52/blob/d29b3cc4e9a88addcd160b613281e461411dc62e/builder/main.py#L201-L204


      
          elif "nrfutil" == upload_protocol and use_adafruit:
              target_firm = env.PackageDfu(
                  join("$BUILD_DIR", "${PROGNAME}"),
                  env.ElfToHex(join("$BUILD_DIR", "${PROGNAME}"), target_elf))

Meaning the firmware is first compiled to .elf as normal, then converted to .hex, and then given as input to the PackageDfu builder command as displayed above to give the firmware.zip package.

That .zip package is then uploaded via this command

github.com

platformio/platform-nordicnrf52/blob/d29b3cc4e9a88addcd160b613281e461411dc62e/builder/main.py#L321-L339


      
          elif upload_protocol == "nrfutil":
              env.Replace(
                  UPLOADER=join(platform.get_package_dir(
                      "tool-adafruit-nrfutil") or "", "adafruit-nrfutil.py"),
                  UPLOADERFLAGS=[
                      "dfu",
                      "serial",
                      "-p",
                      "$UPLOAD_PORT",
                      "-b",
                      "$UPLOAD_SPEED",
                      "--singlebank",
                  ],
                  UPLOADCMD='"$PYTHONEXE" "$UPLOADER" $UPLOADERFLAGS -pkg $SOURCE'
              )
              upload_actions = [
                  env.VerboseAction(BeforeUpload, "Looking for upload port..."),
                  env.VerboseAction("$UPLOADCMD", "Uploading $SOURCE")
              ]

As you can see above, PlatformIO does not use a --key-file private-key.pem command during the package generation, and using upload_flags would only add flags to the UPLOADCMD (via $UPLOADERFLAGS) which is after the ZIP file has already been generated.

PlatformIO’s builder script above does currently not give the user the opportunity to add custom flags in the package generation process, such as a signing key.

I would suggest:

Locally change <user home directory>/.platformio/platforms/nordicnrf52/builder/main.py lines 130-147 by adding your own "--key-file", "private-key.pem", arguments into the array at the correct place. Verify that the argument is included correctly by using the project task Advanced → Verbose Upload, which shows in the end all invoked commands before and during upload.
Open an issue at Issues · platformio/platform-nordicnrf52 · GitHub so that the builder script might make use of a private key file if instructed to do so via the platformio.ini.